deb37cf4c01c6c281300cf08a72f7c964974faeef574a73f13dea9b729934a39

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69045cc110b9d55736654b29d5a17d48_JaffaCakes118.html
Size

1KB
MD5

69045cc110b9d55736654b29d5a17d48
SHA1

b93d8007f6a1f408ff51380a6c567d651e6e16ff
SHA256

deb37cf4c01c6c281300cf08a72f7c964974faeef574a73f13dea9b729934a39
SHA512

10511c7565ef9260eea673271298e80337a5d27ff21337b50898cdadc6ccfd44ecb0320acb1aae865f916c06abdb3f8f9af64b6fe93a634a77aab61fffdc5e9a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14B47D31-1894-11EF-B85E-52C7B7C5B073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085925f5f401d0d47b039d2790baea0a5000000000200000000001066000000010000200000009eba7a21f66498d0d18094b8ee7e5f54bce2d246951d02871506aad1b4f6202f000000000e8000000002000020000000d7999b89806aae5765f51506dbaea5d5b26f652935d6ed2bea82a0a301ef2d43200000001f55257385e876f2a87687d90abfa540208cc545cdd6b25ca8449f342aee9e4b40000000730901e5fef250347a84448e0edd80ceee56bfb2b7aeda16ad3e5d5937fa513874118b5059b3b9f44443fecbba73aea7edc6ab7d267f20b2d8a7e96f55397646	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000085925f5f401d0d47b039d2790baea0a500000000020000000000106600000001000020000000761fdc744634a8103bee49aeffd36417773a4292d64e01b119be0a1aec2e5d87000000000e800000000200002000000025e812c4b40ccec51d4f2af1ac3015e6f64e366a6e7cf5145c82aded9ad5ac8a900000007052adfda2047354b20914408693a0e084e822ebf2f45709895e618eaf0a9201d3a24c96e1add9c8d3d83ebe9cf9c18cb2b1432cd571382ddc4d6396ef04f1011e13f0035ab3e904757d278afbbb775670ff6192fc7541ba3e3e053cfb86c1659c605673c30f6a60084b5aaa892100da83d4f307306d75968a25fcbe729e668b37a903823b6c76ecccd66f823a39f816400000001ccf991ff2d3271ad6e5a6df9164976f69da8c299d5e624c06fcebc2440cdaa79eb9cf0e6048b5e512198f8c7fe95041ac4490b660d9094d9d890364c86b73da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582843"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06a71e9a0acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1728 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1728 iexplore.exe
1728 iexplore.exe
2908 IEXPLORE.EXE
2908 IEXPLORE.EXE
2908 IEXPLORE.EXE
2908 IEXPLORE.EXE

pid	process
1728	iexplore.exe

pid	process
1728	iexplore.exe
1728	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1728 wrote to memory of 2908	1728	iexplore.exe	IEXPLORE.EXE
PID 1728 wrote to memory of 2908	1728	iexplore.exe	IEXPLORE.EXE
PID 1728 wrote to memory of 2908	1728	iexplore.exe	IEXPLORE.EXE
PID 1728 wrote to memory of 2908	1728	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\69045cc110b9d55736654b29d5a17d48_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d586b2190272fbabc5987751bb3e622

SHA1
d0f5817a5c899acecd824a15a7b0288181d57e7e

SHA256
cd493cad692e98f8775b482da95f3a952c8d3f0fcd32a8a5f5df40b068f51198

SHA512
02b7a27117553a900ab43aa766ce4d53bd7cd49248573ed135fc17422b41d40fb0ac912215744ebd066a665c300cf5edf959e445c82b5e19c50b010d4aebda5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8b03ee02380bcfcc71611d44b30532d

SHA1
f7172a2fe3e290cf63e397d4f3ac503fa59d1a93

SHA256
e7b312e46a11ca8a10a222e54c3284e68f41db42795643ca203a7c735b4a8284

SHA512
4c13b0ca55bc378c05e6e9ff48dbc22e321df4044d1c3c134c6637332e1fd8e13d398b1afbe62f9695a5ea58fe739759b1782455591d0c32b6e6699c40ddb88a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f3de76b2e51c2a39831ad89cc78382d

SHA1
29ff2478b5b5cfbfc7572c9a4e29c0566998682f

SHA256
12c8397b503766d296508181cc48d4ea5ab2b630d0f64e5442482c6d7afee8cb

SHA512
9d64f179db7fab2c7d822054954719cadaaa7c6812bcff525d63aa97eb3e662c0d70df21a0f0b1ed4c5e07c278f54323f8e87d94bd0ae4536249bf4ac4b8ce1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
944a67190d08c3c788bbe8ed513c1629

SHA1
057b0a4a502fa966d79d0383f2b93b96bf535eec

SHA256
c4a72c86899f305ba6084ad1cb402e0c7da2c6516ddf05101f01a9f8f75aac75

SHA512
fc5e529baa01364d6150d505527b6eda363b177e9645768210a871a878f090aed13c4197bbbc0c0e823b5c972038846e53f1fdaa952629143d043e3abc592dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fff50a5857db8abd3b870273e2d0115

SHA1
27e712d2906caf6d452f7c9d690ff27aaba46a44

SHA256
4d22f4d1f683c717c9470de08b2ce42753e4db6f90da052f6bddc858e18302bc

SHA512
53795716e44b7c5bcc00ed4f69654a8d58106b9645a105b9e9d87a82d3badfb5b86fef4e4fc58ee96b589e5848f7b0672e792939d9bd537ef2aa28c8c81d4398

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
962f958c6d9d72ad91c0c382e1de5742

SHA1
5d05bd94f1b86fbde3e6cec56c1ea0b175f1ee9f

SHA256
8151916badfcc5e52a65733ccb4adeea98d1747e77f648e9dd7dc12144b43b84

SHA512
c00af80f440bab397170dfaf1c250ebb2338a0a22c4911dace931d8ed54c6f16f92ffbbfdf499a7e8ade6dff269bf0f06e4ac1ac8b08fdc525e69bdfdb3ceaf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c0dfe137a4e9b6757ba3b0250ac7770

SHA1
b0e79e9f1ca40c5d55225752e08322f4ed79edc6

SHA256
be27bfc38fd7e80de20caae594bcb425ed5720319249abc08fe6001b7914c005

SHA512
8223b7221c1d990263a3a8562da9f0d1339bd83a5c635ea8331fead793291d71657a8049147a7b8333b69bd76ebbe7d9798f0c94060962dd56d634350f83401b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c435ab3debe714c7c2c73d389419984

SHA1
ef84500c09cc5726dfcdf01dae615ef6f7c64d00

SHA256
6b78649792c4a42d203e342beb5c64380b131e9f82d49fdc7e9d81930c12c3e0

SHA512
0d828d9d2e29a1859ef3c11abd02ba9f0b7926c715480080ef23e76e8f35f0cea165037b0932eef177360f3650419a0f380c33efd037e968635bf2c18924e185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc4b128a46001021de7c913f9a83bb29

SHA1
95ee0995bbcf0f1f1bc30b9cbcbefb343b8b251b

SHA256
c80381fe37520386ac0d55f3c9fe3bd533be5283af85283c657f69cc540ad39a

SHA512
42cf5288afa3a5239500734641627e9307abd9f7b031d8e56041bb2e188fe09f72bd6e6d47bff842fa830bf03615b3ce3a7f623b479ffd6b4a2ab5ab45248b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
693c0f66993a8d70d2a310645156c517

SHA1
e8bcbf86a97fe484ca32b27aaace6ca34d718231

SHA256
b0a5a11866a9b8063f500c2f0569669702d37365bd6a155f5c60db3a0a51dc12

SHA512
69202413ef6751ae7cb69954d7322a9cd1e8d675c53fb09a97f1341638a90812be5c4c2823167b7cf4db00cf0f9e56722a2230b73849c2b914f8e70ae5704d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A74.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BD2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit